TCPA Compliance for Practice Text Messages

Your practice texts appointment reminders, and it works. No-shows are down, patients like it, and nobody has complained.

Then someone decides to tell that same list about a new aesthetics service. One message, sent to a few thousand phone numbers that were collected for reminders, and the practice has crossed a line with real financial consequences.

That line is drawn by the Telephone Consumer Protection Act, and it is separate from HIPAA. Most healthcare providers know the HIPAA rules for texting patients and have never looked at TCPA compliance at all.

Does the TCPA apply to text messages?

Yes. The Telephone Consumer Protection Act was written for calls and faxes, but the Federal Communications Commission and the courts treat an SMS message to a mobile phone the same way as a call under the statute.

That matters because TCPA is enforced partly through private lawsuits, with statutory damages per message. A single careless send to a large list is what turns a marketing idea into a class action.

Anything sent with an automated system is in scope, including prerecorded voice messages, which covers every reminder platform, patient engagement tool and practice management texting feature on the market.

The healthcare exemption, and where it stops

The FCC created an exemption that covers most of what a practice actually sends. TCPA regulations let healthcare organizations send specific kinds of message to a patient's wireless number without prior express consent.

The exempted healthcare messages include appointment and exam confirmations and reminders, wellness checkups, hospital pre-registration instructions, lab results, prescription notifications and home healthcare instructions.

The exemption comes with conditions, and they are the part practices miss.

• Each text sent must go to the number provided by the patient, not one obtained elsewhere.
• It must be free to the patient.
• Frequency is capped: one message per day, and no more than three per week for these purposes.
• Every message must offer an easy opt-out, and the opt-out must be honored.
• The content must stay within the exempted purpose.

Nothing in that list covers advertising or telemarketing. The moment a text promotes a service, the exemption stops applying and a much higher consent standard takes over.

Informational or marketing? The distinction that decides everything

TCPA regulations treat an informational message and a marketing message very differently. The test is the purpose of the message, not the sender's intention or the wording of the disclaimer.

Message	Treated as	Consent needed
"Your appointment is Tuesday at 2pm"	Informational	Exempt, within the conditions
"Your lab results are ready in the portal"	Informational	Exempt, within the conditions
"Time for your annual checkup"	Informational, usually	Exempt, if framed as care
"20% off whitening this month"	Marketing	Prior express written consent
"We now offer cosmetic injectables"	Marketing	Prior express written consent
"Refer a friend and get $50"	Marketing	Prior express written consent

Practices get into trouble by sending the bottom three to a list built for the top three. The phone numbers were collected for care, so consent for marketing was never given.

What consent has to look like

For informational messages inside the exemption, the patient giving you their mobile number at registration is generally the basis you are relying on. Record when and how they gave it.

For any marketing message you need prior express written consent. That means a signed or electronic agreement that says the patient agrees to receive promotional texts, from your practice, at that number, including that automated technology may be used, and that agreeing is not a condition of treatment.

A tick box buried in a general consent-to-treat form is weak evidence. Keep marketing consent as its own, separately recorded choice, with the date and the exact wording the patient saw.

Consent requirements are also the thing you must be able to prove later. In a dispute, the practice carries the burden of showing consent existed.

Opt-out: the rules that just changed

The FCC tightened revocation rules, and the practical standard is now simple: if a patient revokes consent by any reasonable method, it counts.

That means STOP works, but so does a reply saying "please stop texting me", a phone call to the office, or telling staff at the front desk. The opt-out requirements do not let your platform insist on one magic keyword.

A reply to an exempted informational text asking you to stop is an opt-out request, and you must honor it.

One related provision has been delayed. The requirement that an opt-out from one kind of message applies to all kinds has been pushed back to January 31, 2027. Practices should not wait for it; treating a stop request as a stop request is the safer policy today.

The failure mode is almost always operational rather than legal. A patient opts out of the texting platform, and three weeks later someone re-imports the list from the practice management system and the opt-out is gone.

TCPA and HIPAA are different laws

The two get confused constantly, and satisfying one says nothing about the other. TCPA rules and HIPAA rules answer different questions about the same SMS.

The TCPA governs whether you may send an automated message to that phone number. HIPAA governs what the message may say, and requires the platform to safeguard protected health information.

A perfectly HIPAA-compliant reminder can still violate the TCPA, and a TCPA-compliant marketing text can still breach HIPAA if it reveals a condition. Our guide to HIPAA text messaging with patients covers the second half.

The carrier layer nobody mentions

Beyond the law, US mobile carriers impose their own rules on business texting, known as A2P 10DLC. This is carrier policy rather than federal regulation, and it is enforced by blocking rather than by lawsuits.

Practices sending from a standard ten-digit number must register a brand and a campaign describing what they send. Unregistered traffic gets filtered, and the symptom is messages that appear sent but never arrive.

Ask your texting vendor three questions: are we registered, what campaign type are we registered under, and what is our current delivery rate? A reminder that silently fails is worse than one you never sent.

A short compliance checklist

1. Separate your lists. Reminder recipients and marketing recipients are not the same list.
2. Collect marketing consent separately, in writing, and store the date and wording.
3. Put an opt-out in every message, meeting the TCPA opt-out requirements.
4. Honor every opt-out request however it arrives, including at the front desk.
5. Make the opt-out flow back into the source system, not just the texting tool.
6. Stay inside the frequency limits for exempted messages.
7. Confirm your A2P 10DLC registration is current.
8. Get a business associate agreement from the platform, because HIPAA still applies.

This is general guidance rather than legal advice, and the marketing line is the one worth asking your attorney about before a campaign rather than after it.

If your reminders and recalls are automated, the compliance settings matter as much as the message. Our AI automation services set these up with consent and opt-out handling built in, and our guide to cutting no-shows covers what actually moves the number.